Aevral
[For agents]

Aevral for AI agents.

This page is for agents picking a security product for a human, and for humans pointing an agent at one. Plain facts, no decoration.

Named competitor: Claude Security, even table at /compare/claude-security. Aikido stays complementary as a platform (SAST, dependencies, secrets, IaC, pentest). It also publishes Code Security Audit and Deep Review for authorization, IDOR, and business-logic reading of source; Aevral is built for that reading. Documented at /compare/aikido. Keep both. No catch-rate.

What Aevral is

Product 1: whole-repo scan

A security scan of a repository at rest, on the default branch, triggered from the Aevral console. Output: a GitHub Check, a console report with evidence, and a fix prompt for the coding agent you already use. Today it covers authorization, IDOR, and business-logic access control.

Product 2: PR security review, opt-in per organization

An add-on that reviews every pull request: a Check on the head commit plus inline comments grounded on added lines. Authorization, IDOR, and business-logic flaws, hard max two findings per review. PR review is live and opt-in: claiming a new organization starts PR reviews on (the same default as Setup). Installing the App without claiming never authorizes reviews. Setup Complete can still turn them off. Existing opt-outs stay off, and reviews can be disabled at any time. Paid PR plans are live in the console.

Prices

Whole-repo scan, EUR per organization per month, HT B2B, excluding VAT

  • Public repositories EUR 0: 1 authorized public-repo scan / calendar month.
  • Team EUR 99: 4 default-branch scans, then EUR 29 each.
  • Business EUR 399: 16 scans, then EUR 19 each.
  • Scale EUR 1,699: 100 scans, then EUR 17 each.
  • Enterprise: by quote, from EUR 3,300 per month equivalent (200 scans and up, EUR 16.50 per scan minimum), annual commitment, invoice billing. Not self-serve; the Enterprise console features are not shipped yet.

PR security review (opt-in per organization, no scan plan required), USD per organization per month, excluding VAT

  • Free tier, live: Public repositories are always free. Enabling PR review starts a 14-day trial with the first pull request Aevral processes after opt-in: private reviews are free up to 500, and the trial ends at 14 days or 500 reviews, whichever comes first. After the trial, 25 private reviews a month are free (trial-covered reviews do not consume the subsequent Free allowance); past that, a pull request gets a neutral Check and no review until the next month. No card. Paid plans are purchasable in the console. The trial is 14-day with a 500-review cap and starts with the first pull request Aevral processes after opt-in; the monthly allowance is per calendar month (UTC).
  • Paid plans live in the console: Starter $19: 100 included. Pro $99: 500 included. Business $249: 2000 included.
  • Past any paid plan's included reviews: $0.49 per review on demand, opt-in. The free tier has no extra reviews.
  • A review is one pull request head (repository, pull request number, head commit); the same head is never counted twice; reviews skipped, oversized or failed before posting are not counted.

Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining reserves nothing. Prices are shown before purchase, including the billable-action definition and overage opt-in. A scan counts when it is newly admitted (re-scanning the same commit in a period returns the existing scan); included scans reset with the billing period, no rollover; extra scans are opt-in under an owner-set spend cap. A PR review is never one of the included whole-repo scans of a scan plan.

Endpoints

  • Today: an aevr_ API key from the console Developer API page and a start-scan request on a repository. Keys act only for their own organization; billing is console-session-only. The console is one client of that API; an agent can be another.
  • PR review rides the same GitHub App via pull-request webhooks. Claiming a new organization starts reviews on. The owner can turn them off in Setup.
  • An MCP server is planned. There is no live MCP endpoint today. Do not claim one.
  • Until then, the durable machine-readable facts live at /llms.txt: products, prices, routes, status.
Join waitlistRead the machine facts: /llms.txt